mike007 : Prosím o kontrolu logu Vyřešeno

[mike007]

A nesmaže mu to nějaké nastavení?

Jinak stále od něj čekám výsledek akce Combofixu. Jakmile jej dostanu, dám vědět.

[Reklama]

[mike007]

Tak Combofix prý nepomohl. Zkusí to resetování protokolu.

[paul27]

Tak Combofix prý nepomohl. Zkusí to resetování protokolu.

Možná by to chtělo log, CF nesmaže vše - je potřeba mu to ručně zadat.

[mike007]

ComboFix 08-04-29.5 - Martin Dušek 2008-04-30 19:12:51.1 - NTFSx86
Running from: F:\CD\Antispyware\Combofix\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
/wow section - STAGE 38
pv: No matching processes found
Nesprávná syntaxe příkazu


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\components
C:\WINDOWS\system32\components\prxf.dll
C:\WINDOWS\system32\djjqabto.ini
C:\WINDOWS\system32\drivers\grande48.sys
C:\WINDOWS\system32\drivers\Hlf41.sys
C:\WINDOWS\system32\fdtqduxq.ini
C:\WINDOWS\system32\hkmrwlkm.ini
C:\WINDOWS\system32\kjuhexqu.ini
C:\WINDOWS\system32\kuzlyt.dat
C:\WINDOWS\system32\kuzlyt_nav.dat
C:\WINDOWS\system32\kuzlyt_navps.dat
C:\WINDOWS\system32\lkxdibxb.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\model.dat
C:\WINDOWS\system32\nqtwa.bak1
C:\WINDOWS\system32\nqtwa.bak2
C:\WINDOWS\system32\nqtwa.ini
C:\WINDOWS\system32\obuxwrcq.ini
C:\WINDOWS\system32\pqisxits.ini
C:\WINDOWS\system32\reublmsr.ini
C:\WINDOWS\system32\sdhjrxfu.ini
C:\WINDOWS\system32\taskmgr.com
C:\WINDOWS\system32\tgmepmse.ini
C:\WINDOWS\system32\tnquhkpl.ini
C:\WINDOWS\system32\usqtqrmg.ini
C:\WINDOWS\system32\vaxdisce.ini
C:\WINDOWS\system32\vezkpchsnn.dat
C:\WINDOWS\system32\vezkpchsnn.exe
C:\WINDOWS\system32\vezkpchsnn_nav.dat
C:\WINDOWS\system32\vezkpchsnn_navps.dat
C:\WINDOWS\system32\wxvqirbg.ini
C:\WINDOWS\system32\xakorvxt.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_HLF41
-------\Service_Hlf41
-------\Service_HLF41


((((((((((((((((((((((((( Files Created from 2008-03-28 to 2008-04-30 )))))))))))))))))))))))))))))))
.

2008-04-30 19:14 . 2008-04-30 19:14 196,886 --a------ C:\Documents and Settings\Martin Ducatchme.zip
2008-04-28 20:40 . 2008-04-28 20:40 <DIR> d-------- C:\sdfix
2008-04-28 20:13 . 2007-10-04 17:10 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-04-28 20:13 . 2007-10-04 17:10 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-04-28 20:13 . 2007-10-04 17:11 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-04-28 20:12 . 2007-10-04 17:10 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-04-28 20:11 . 2008-04-28 20:16 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-04-25 20:31 . 2008-04-25 20:31 29 --a------ C:\WINDOWS\system32\updodrue.tmp
2008-03-20 10:09 . 2008-03-20 10:09 1,845,248 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys
2008-03-19 18:26 . 2008-03-19 18:26 <DIR> d-------- C:\Program Files\QIP
2008-03-19 17:09 . 2008-03-19 17:09 0 --a------ C:\WINDOWS\system32\chrome.manifest
2008-03-19 16:57 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2008-03-11 15:54 . 2008-03-19 17:38 <DIR> d-------- C:\Program Files\ICQToolbar
2008-03-10 21:29 . 2008-03-10 21:30 166 --a------ C:\WINDOWS\Jablko.ini
2008-03-10 21:26 . 2008-03-10 21:26 169 --a------ C:\WINDOWS\Vanilka.ini
2008-03-10 21:23 . 2008-03-10 21:26 169 --a------ C:\WINDOWS\Citron.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-27 12:21 87,312 ----a-w C:\WINDOWS\system32\drivers\cmdGuard.sys
2008-04-27 12:21 23,824 ----a-w C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-04-27 11:57 --------- d-----w C:\Program Files\Spyware Terminator
2008-04-09 20:27 --------- d-----w C:\Program Files\Opera
2008-03-11 13:56 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-04 11:29 138,752 ----a-w C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2008-01-28 23:02 737,280 ----a-w C:\WINDOWS\iun6002.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-07 01:15 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Zástupce stránky vlastností sběrnice High Definition Audio"="HDAudPropShortcut.exe" [2004-03-17 17:10 61952 C:\WINDOWS\system32\Hdaudpropshortcut.exe]
"Cmaudio"="cmicnfg.cpl" []
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-09-29 08:15 344064]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2004-09-29 11:37 28672]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 20:42 32768]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-04-22 22:42 77824]
"HydraVisionDesktopManager"="C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe" [2003-09-15 22:00 270336]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2004-12-20 20:41 33792]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344]
"iconcache"="" []
"cleanup"="" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43 83608]
"SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-03-04 13:29 2957824]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2004-09-29 11:37 28672]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsNetHood"= 0 (0x0)
"NoSimpleStartMenu"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.xvid"= xvid.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"E:\\Hry\\Diablo II\\Game.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\WINDOWS\system32\drivers\sp_rsdrv2.sys [2008-03-04 13:29]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R3 cmudax;C-Media High Definition Audio Interface;C:\WINDOWS\system32\drivers\cmudax.sys [2004-07-27 18:06]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2004-08-03 23:04]
S3 sm56pci;sm56pci;C:\WINDOWS\system32\DRIVERS\sm56pci.sys [1999-11-05 21:42]

.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-30 19:16:45
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Completion time: 2008-04-30 19:19:00 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-30 17:18:54

Adresářů: 9, Volných bajtů: 3,627,646,976
Adres ý…: 10, Volněch bajt…: 3,538,128,896

154 --- E O F --- 2008-04-10 19:36:32

[paul27]

Celkem slušná zbírka tam byla, vše pod Other deletions byly viry.

Opět vypněte veškeré spuštěné programy (webový prohlížeč, messenger, ...). Přesuňte Combofix na plochu(zvýrazňuji, protože při tomto testu na ploše nebyl) (pokud ho tam ještě nemáte) - otevřete si poznámkový blok - do něj zkopírujte text z nasledujícího okna:

Kód: Vybrat vše

File::
C:\WINDOWS\system32\updodrue.tmp
C:\WINDOWS\iun6002.exe

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iconcache"=-
"cleanup"=-

Text uložte jako CFScript.txt na plochu - po uložení uchopte vámi vytvořený soubor .txt levým tlačítkem myši a přesuňte jej nad ikonu ComboFixu - nad ikonou ComboFixu soubor .txt upusťte - spustí se ComboFix - a CF začne znova scanovat, nakonci scanování se pokusí CF smazat zadané soubory či něco jiného, co jsme mu zadali - po provedení akce se opět zobrazí okno poznámkového bloku s textem, který sem zkopírujte a vyčkejte prosím na další rady :)

[mike007]

info a další pokyn předám. Zítra dám vědět. Zatím díky.

[mike007]

Tak tady je log z Comboboxu :

Mimochodem, internet mu už šlape!

ComboFix 08-04-29.5 - Martin Dušek 2008-04-30 23:08:25.3 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.232 [GMT 2:00]
Running from: C:\Documents and Settings\Martin Dušek\Plocha\ComboFix.exe
Command switches used :: C:\Documents and Settings\Martin Dušek\Plocha\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\iun6002.exe
C:\WINDOWS\system32\updodrue.tmp
.
/wow section - STAGE 38
pv: No matching processes found
Nesprávná syntaxe příkazu


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\iun6002.exe
C:\WINDOWS\system32\updodrue.tmp

.
((((((((((((((((((((((((( Files Created from 2008-03-28 to 2008-04-30 )))))))))))))))))))))))))))))))
.

2008-04-30 22:22 . 2008-04-30 22:22 <DIR> d-------- C:\Program Files\Java
2008-04-30 22:22 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-04-30 22:20 . 2008-04-30 22:20 <DIR> d-------- C:\Program Files\Common Files\Java
2008-04-30 19:19 . 2008-04-30 19:19 <DIR> d-------- C:\Documents and Settings\Martin Dušek
2008-04-30 19:14 . 2008-04-30 19:14 196,886 --a------ C:\Documents and Settings\Martin Ducatchme.zip
2008-04-28 20:13 . 2007-10-04 17:10 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-04-28 20:13 . 2007-10-04 17:10 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-04-28 20:13 . 2007-10-04 17:11 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-04-28 20:12 . 2007-10-04 17:10 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-04-28 20:11 . 2008-04-28 20:16 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-03-20 10:09 . 2008-03-20 10:09 1,845,248 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys
2008-03-19 18:26 . 2008-03-19 18:26 <DIR> d-------- C:\Program Files\QIP
2008-03-19 17:09 . 2008-03-19 17:09 0 --a------ C:\WINDOWS\system32\chrome.manifest
2008-03-19 16:57 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2008-03-11 15:54 . 2008-03-19 17:38 <DIR> d-------- C:\Program Files\ICQToolbar
2008-03-10 21:29 . 2008-03-10 21:30 166 --a------ C:\WINDOWS\Jablko.ini
2008-03-10 21:26 . 2008-03-10 21:26 169 --a------ C:\WINDOWS\Vanilka.ini
2008-03-10 21:23 . 2008-03-10 21:26 169 --a------ C:\WINDOWS\Citron.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-30 20:13 --------- d-----w C:\Program Files\Spyware Terminator
2008-04-27 12:21 87,312 ----a-w C:\WINDOWS\system32\drivers\cmdGuard.sys
2008-04-27 12:21 23,824 ----a-w C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-04-09 20:27 --------- d-----w C:\Program Files\Opera
2008-03-11 13:56 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-04 11:29 138,752 ----a-w C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
.

((((((((((((((((((((((((((((( snapshot@2008-04-30_22.52.04.10 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-30 20:49:25 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-04-30 21:11:06 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2008-04-30 20:49:33 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_618.dat
+ 2008-04-30 21:11:14 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_618.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-07 01:15 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Zástupce stránky vlastností sběrnice High Definition Audio"="HDAudPropShortcut.exe" [2004-03-17 17:10 61952 C:\WINDOWS\system32\Hdaudpropshortcut.exe]
"Cmaudio"="cmicnfg.cpl" []
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-09-29 08:15 344064]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2004-09-29 11:37 28672]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 20:42 32768]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-04-22 22:42 77824]
"HydraVisionDesktopManager"="C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe" [2003-09-15 22:00 270336]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2004-12-20 20:41 33792]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344]
"SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-03-04 13:29 2957824]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2004-09-29 11:37 28672]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsNetHood"= 0 (0x0)
"NoSimpleStartMenu"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.xvid"= xvid.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"E:\\Hry\\Diablo II\\Game.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\WINDOWS\system32\drivers\sp_rsdrv2.sys [2008-03-04 13:29]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R3 cmudax;C-Media High Definition Audio Interface;C:\WINDOWS\system32\drivers\cmudax.sys [2004-07-27 18:06]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2004-08-03 23:04]
S3 sm56pci;sm56pci;C:\WINDOWS\system32\DRIVERS\sm56pci.sys [1999-11-05 21:42]

.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-30 23:11:45
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Completion time: 2008-04-30 23:13:54 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-30 21:13:48
ComboFix2.txt 2008-04-30 20:52:26
ComboFix3.txt 2008-04-30 17:19:01

Adresářů: 7, Volných bajtů: 5,182,636,032
Adres ý…: 8, Volněch bajt…: 5,170,278,400

132 --- E O F --- 2008-04-10 19:36:32

[mike007]

Paul27, zlobyl : Díky za pomoc. Myslím, že už je po problému.

[paul27]

I za Zlobyla nemáš zač. CF už je ok. Kdyby něco ej vědět.